Robinhood CEO Vlad Tenev’s X Account Hacked to Shill Fake ‘Vladhood’ Memecoin — Hacker Still Collecting Fees

Robinhood confirmed Wednesday that CEO Vlad Tenev’s X account was hacked and weaponized to push a fraudulent memecoin called “Vladhood” (ticker: VLAD) — and onchain records show the scam token was already deployed on Robinhood Chain a full 46 minutes before the promotional post ever surfaced on his timeline.

The malicious post pointed followers straight at a token contract address. Buy in, the pitch implied. Robinhood caught the compromise and yanked the post, but the damage mechanism was already running — and kept running long after the scrub, because that’s how this was built. According to The Defiant, the attacker continued collecting fees from the contract even after the post disappeared from Tenev’s account. The fee-collection structure was baked into the smart contract at deployment and operates entirely independently of whatever social media copy was used to advertise it.

That 46-minute gap is the detail that matters. It tells you the attacker pre-positioned the contract, locked in the fee structure, and then used Tenev’s verified account — enormous reach, implicit financial credibility — to funnel buyers into an asset they’d controlled since the first block. Not opportunistic spam. Infrastructure.

CoinTelegraph first reported the hack; Decrypt corroborated the token’s name and ticker. The choice of Robinhood Chain as the deployment network wasn’t incidental — the chain had recently surpassed Coinbase’s Base on daily active users within three weeks of launch, driven largely by memecoin activity, and an attacker hunting for maximum visibility and liquidity for a scam token would naturally land on the chain where memecoin trading is concentrated and where the CEO’s own brand carries the most resonance.

This fits a clear, accelerating pattern of social-engineering attacks on high-profile accounts — specifically executives whose names carry financial weight. Roughly six days before the Tenev hack, Airbnb CEO Brian Chesky’s X account was also compromised, though that breach involved no scam token links or investment pitches; different motive, or maybe an aborted second stage. The more lucrative template had already played out earlier this year when the SpaceX/Starlink X account was hijacked to push the SCATMAN memecoin, netting attackers approximately $135,000, per crypto.news. One verified account. One well-timed post. A pre-deployed contract — five-figure returns in minutes.

What separates Vladhood is operational sophistication. Deploying the contract 46 minutes before the post suggests the attacker had control of the X account — or at minimum, high confidence they soon would — before the token even existed onchain. Smart contracts do not care whether their marketing is still live; once deployed, they execute as written. Anyone who bought VLAD after the post was deleted was still paying fees to the attacker, with nothing left on social media to explain why.

The broader market backdrop adds texture. Total crypto market cap sits at $2,301.66 billion, down 1.43% over 24 hours. The Fear & Greed Index reads 31 out of 100 — firmly “Fear” territory. BBTC$64,222.00▼1.00% trades at $65,104, down 1.2% on the day; EETH$1,861.68▼1.30% sits at $1,880, off 2.4%. When sentiment is sour and traders are already hunting yield in speculative corners of the market, a verified account promoting a new token on a trending chain lands on an audience primed to take risk.

Robinhood has not disclosed how the account was accessed — SIM swap, credential compromise, third-party tool breach, or some other vector. The company confirmed the compromise and the removal of the post. No personal statement from Tenev had been issued at publication.

The Vladhood contract remains live onchain. The hacker’s fee-collection address continues to accrue. The next concrete data point to watch: onchain analytics firms publishing total volume routed through the VLAD contract, which will show exactly how many buyers that 46-minute head start and one verified post managed to capture.